EP3308278B1 - Procédé de mise à jour de données de personnalisation - Google Patents

Procédé de mise à jour de données de personnalisation Download PDF

Info

Publication number
EP3308278B1
EP3308278B1 EP16728664.0A EP16728664A EP3308278B1 EP 3308278 B1 EP3308278 B1 EP 3308278B1 EP 16728664 A EP16728664 A EP 16728664A EP 3308278 B1 EP3308278 B1 EP 3308278B1
Authority
EP
European Patent Office
Prior art keywords
data
personalisation data
terminal
updated
security document
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP16728664.0A
Other languages
German (de)
English (en)
Other versions
EP3308278A1 (fr
Inventor
Frank Müller
Steffen Scholze
Matthias SCHWAN
Klaus-Dieter Wirth
Elke FILZHUTH
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Bundesdruckerei GmbH
Original Assignee
Bundesdruckerei GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bundesdruckerei GmbH filed Critical Bundesdruckerei GmbH
Priority to EP22160148.7A priority Critical patent/EP4068103A1/fr
Publication of EP3308278A1 publication Critical patent/EP3308278A1/fr
Application granted granted Critical
Publication of EP3308278B1 publication Critical patent/EP3308278B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/0223—User address space allocation, e.g. contiguous or non contiguous base addressing
    • G06F12/023—Free address space management
    • G06F12/0238—Memory management in non-volatile memory, e.g. resistive RAM or ferroelectric memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/355—Personalisation of cards for use
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/04—Addressing variable-length words or parts of words
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/17—Embedded application
    • G06F2212/178—Electronic token or RFID
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/72—Details relating to flash memory management
    • G06F2212/7202—Allocation control and policies

Definitions

  • the invention relates to a method for updating personalization data of a valuable or security document, wherein the valuable or security document can in particular be a sovereign valuable or security document.
  • personalization data such as passport photos, fingerprints or the like are usually stored in a non-volatile memory area of the chip card, which can be used by a processor of the chip card, for example in the course of an authentication process to determine the identity of a document owner.
  • Writable files on value or security documents for example in the form of chip cards, for storing personalization data and for personalizing the value or security document are characterized by a physical storage length with a physical file end.
  • a corresponding file has a predefined physical storage length, which corresponds to the storage space created. If personalization data is stored in the file, the file also has a logical end of file.
  • the logical end of file indicates the end of a logically related section of the occupied storage space.
  • the physical end of file specifies the maximum amount of data that can be written to the file, i. H. it corresponds to the end of the memory block reserved for the corresponding file.
  • the logical end of file indicates up to which point in the memory block the file is already filled and up to which position the file is to be read.
  • a completely filled memory block i. H. a file completely filled with stored data, the physical end of file and the logical end of file coincide.
  • a common auxiliary construction in this case is to use the complete memory block, i. H. the complete file, first to be overwritten with zeros, whereby the logical file end corresponds to the physical file end. Only after this process is the data to be updated written to the memory block. This usually shows where the updated data ends. However, the data content of the updated data does not correspond to the written content, since the added zeros could also be read when the written content is read out.
  • the excess zeros can lead to problems in particular if the chip card is to create a signature for the content of a file, for example, and this signature is later to be checked outside the card. In this case, it is not clear whether the corresponding zeros are a logical part of the signed data or not. This can lead to problems when checking the signature of the corresponding files.
  • the inevitable reading of excess residual data means an increase in the workload when reading out the contents of the corresponding files.
  • File structures are known from the prior art which include a length specification of a logically related file section, e.g. B. TLV files. If several such TLV files are configured as file structures arranged one after the other, it is not clear without further information whether the data that are directly connected to the logical file structures delimited by the length specification are negligible residual data or other meaningful, logically related data data sections.
  • the invention is based on the object of creating an improved method for updating personalization data of a value or security document, which in particular also enables the personalization data to be changed securely in sovereign applications.
  • a “value or security document” is understood to mean paper-based and/or plastic-based documents, for example in the form of chip cards.
  • Valuable or security documents include, for example, electronic ID documents, in particular passports, identity cards, residence permits, visas and driving licenses, vehicle registration documents, vehicle registration documents, company ID cards, health cards, signature cards, SIM cards or other ID documents, means of payment, in particular banknotes, bank cards and credit cards, bills of lading or other proofs of entitlement, in which a data store for storing the at least one attribute is integrated.
  • a value or security document comprises in particular a "chip card” which has at least one data memory for storing at least one attribute or personalization data and a communication interface for reading out the attribute or personalization data.
  • the document preferably has a secure memory area, for example in the form of a chip card, for storing the at least one attribute, in order to prevent the attribute stored in the memory area from being changed in an unauthorized manner or read out without the authorization required for this.
  • a “protected memory” is understood to mean, in particular, a non-volatile electronic memory which allows access to data stored in the memory only after a cryptographic access condition has been checked. Furthermore, a protected memory can have access management, which allows specific users who have appropriate access authorization to access the memory stored data granted after identification of the user. However, it is not possible to read or write the data from the protected memory without the appropriate authorization.
  • the memory of the value or security document is a protected memory.
  • chip card operating systems with a hierarchical chip card file system are known, as specified in ISO/IEC 7816-4, for example.
  • Such a chip card file system usually has a root directory called "Masterfile”, abbreviated MF.
  • MF masterfile
  • DF directory files
  • the MF is a special form of the DF.
  • a data file is a file dependent on a DF, which is also referred to as an elementary file, abbreviated to EF.
  • an MF does not necessarily have to be present. Then each application manages its data in a DF without a higher-level MF. The root of the DF is then set using an application identifier (AID) directly when the application is selected.
  • AID application identifier
  • a master file is therefore a special case of a dedicated file and represents the entire memory available in a chip card or a value or security document for the data area.
  • the chip card file system can also contain data objects which, in principle, cannot be accessed externally.
  • a data object contains a key, in particular a private key of an asymmetric cryptographic key pair, a password and/or cryptographic parameters.
  • Such internal data objects are also referred to as Internal EF.
  • Both an EF and a DF can contain control data, such as an access condition to the EF or to the files dependent on a DF.
  • Control data is generally stored in the EFs.
  • control data of a value or security document is understood to mean the assigned administrative data which, in particular, define at least one access condition for access to the personalization data.
  • control data can also contain an indication of the position of the file in question in the chip card file system, for example in the form of a pointer to the respective successor node in the file tree of the chip card or of the value or security document, as well as e.g. a file identifier (FID) and an application Identifier (AID).
  • FID file identifier
  • AID application Identifier
  • Personalization data is understood to mean all data stored in the file system of the chip card operating system that can only be used internally by the chip card operating system at runtime (e.g. key and associated cryptographic parameters) or can be read out in compliance with the access conditions stored in the control data (e.g. data of the owner ).
  • personalization data is understood to mean data that requires a terminal application program that is interoperable with the chip card or a value or security document, such as biometric data, in particular fingerprint data, facial biometric data and/or iris scan data that a terminal needs for a biometric authentication required. Such sensitive personalization data may only be read from the chip card or value or security document after prior authentication of the terminal, with the cryptographic access conditions required for this being specified by the respective control data.
  • the power supply for the processor means of the chip card is usually provided by a terminal via an RFID interface. If the document were to be removed from the terminal too early during an update process, the power supply to the document would be interrupted and any update process that might have been triggered could not be completed. This could potentially make the document unusable. Embodiments of the invention could have the advantage that this risk can be effectively avoided by the document for example in a Slot or another type of mechanical recording of the terminal is fully included and thus protected from access by a user. After the end of the reloading process, the document could then be ejected from the mechanical receptacle of the terminal.
  • the wear and tear on the document can be reduced to a minimum despite the use of a mechanical holder.
  • the contact surface between the document and the holder of the terminal is irrelevant for the communication between the document and the terminal, as well as for the coupling of energy to operate the document.
  • friction effects on the surface of the document body do not impair the functionality of the document.
  • by combining mechanical recording with contactless communication the integrity of the data stored on the document can be preserved, since premature removal of the document from the terminal can be ruled out. This ensures uninterrupted communication and power supply during the update process.
  • Embodiments of the invention can have the advantage that the logical end of the personalization data in the EFs is clearly defined by the pointer stored in the chip card file system. This clearly defines the point up to which the EF is to be read. Data that is arranged after the logical end defined by the pointer is not read out and can therefore not lead to ambiguities. In addition, it can be ensured in this way that no unnecessary reading processes are carried out or no unnecessarily extensive amounts of data are read out. Thus, the efficiency of the reading process is increased.
  • the personalization data can be, for example, an address of the owner of the value or security document.
  • the personalization data can be, for example, an address of the owner of the value or security document.
  • the DF is an MF.
  • further files, EFs and/or DFs are combined in the MF, it being possible for the DFs in turn to each comprise at least one EF.
  • the pointer is stored in the control data of the associated EF.
  • the DF comprises a plurality of EFs and a pointer table, the pointer table associating each EF with a pointer which indicates the logical end of the personalization data stored in the associated EF.
  • Embodiments of the invention can have the advantage that the pointer information is provided in a central pointer table, which increases the clarity of the system.
  • the present invention is particularly advantageous if the updated personalization data is shorter than the previous personalization data. However, even if the updated personalization data is longer and the logical end is thus shifted backwards, the present invention offers the advantage that the logical file end of the updated personalization data is clearly defined.
  • the updated personalization data are shorter than the first personalization data, so that the logical end of the updated Personalization data is arranged before the logical end of the first personalization data.
  • Embodiments of the present invention may have the advantage that personalization data is only written to an EF if the resulting length of the updated personalization data does not exceed the length of the EF. It can thus be prevented that errors occur when writing the updated personalization data.
  • Embodiments of the invention can have the advantage that the probable logical end of the updated personalization data can thus be determined efficiently.
  • the logical end of the file is set to the end of the second personalization data by creating an updated pointer indicating the logical end of the updated personalization data.
  • Embodiments of the invention can have the advantage that the logical end of file can be determined easily and reliably. Once the personalization data is written to the EF, the logical end of file is placed directly after the currently written data block of personalization data.
  • the write command is a write command in a sequence of write commands, with a last write command in the sequence of write commands comprising an indicator which indicates that the last write command is a final write command, and with the preceding write commands each comprising an indicator which indicates another write command follows.
  • Embodiments of the invention can have the advantage that a plurality of write commands can thus be used for a plurality of personalization data. This is advantageous, for example, when the personalization data to be written is very extensive and it is necessary for reasons of data transmission or predefined data formats to divide the personalization data to be written into a plurality of data blocks, each of which is assigned a write command. Furthermore, embodiments of the present invention open up the possibility that different personalization data or parts of personalization data can be updated at different points of the EF.
  • the various write commands can be linked, for example, via a command chaining bit in the CLASS byte according to ISO 7816-4 of the write command.
  • a bit value of 1 indicates that a further write command follows, while a bit value of 0 indicates that this is a final write command.
  • the pointer is not updated until an indicator in the form of a bit value 0 indicates that this is the final write command. Then the logical end of file is placed after the last updated personalization data.
  • the method comprises: Before updating the pointer, checking using the indicator whether the write command is a final write command, if the write command is not a final write command, executing the next write command in the sequence, if the write command is a final write command, setting the logical end of the file after executing the final write command to the end of the updated personalization data by creating an updated pointer indicating the logical end of the updated personalization data
  • Embodiments of the invention may have the advantage that the logical end of file can be determined efficiently. No further information, such as write commands, is required for this. The entire write process can thus be configured more efficiently, even in the case of a plurality of write commands.
  • the logical end of file is placed at the end of the updated personalization data in response to a selection of another file and/or directory by creating an updated pointer that indicates the logical end of the updated personalization data.
  • Embodiments of the invention can have the advantage that additional auxiliary constructions such as overwriting the entire content of the EF with zeros are not required. This saves time on the one hand and on the other hand there is no need for an additional write command that would have to be triggered externally.
  • the logical content of the EF always matches the actually written content in update methods according to the present disclosure, ie in operations on the content of the EF, such as reading out the corresponding personalization data, negligible residual data need not be taken into account.
  • the first personalization data is updated by overwriting it with the second personalization data, beginning at the beginning of the first personalization data.
  • Embodiments of the present invention can have the advantage that no additional information about the start of the writing process is required, as a result of which the entire writing process can be made more efficient.
  • the write command includes an offset value that determines a starting point within the memory length of the EF for updating the first personalization data, and the first personalization data is updated by overwriting it with the second personalization data.
  • Embodiments of the invention can have the advantage that the starting point for updating the personalization data can be chosen flexibly. This is advantageous if the personalization data stored in the EF is very extensive and only a small part of the stored first personalization data has to be updated with second personalization data. In this case, by using an offset value in the write command, it can be avoided that the entire personalization data has to be updated.
  • the first personalization data is the address of the owner of the value or security document and if the owner moves house only the house number changes, the entire address does not have to be replaced, but simply replacing the house number with the new house number in to update the EF containing the address.
  • Another example is an extensive certificate in which the validity of the signature has expired. Embodiments of the present invention allow only the signature of the certificate to be replaced without having to replace the entire certificate.
  • the first personalization data is read before updating, a starting point within the memory length of the EF for updating the first personalization data is determined on the basis of the first personalization data read out, and the first personalization data is updated by overwriting it with the second personalization data.
  • Embodiments of the invention can have the advantage that a starting point for updating the personalization data is also possible without knowledge of the first personalization data.
  • the content of the personalization data or its structure must be known when the write command is created in order to be able to determine which section corresponds to the data to be updated. Determining the starting point on the basis of personalization data, which is only read out in the course of the writing process, makes it possible to replace data even without the relevant prior knowledge.
  • the starting point can be set either automatically or manually.
  • the read out first personalization data on the value or security document or the terminal can thus be analyzed, for example on the basis of corresponding criteria which are defined in the write command.
  • the corresponding data can be displayed, for example, on a display device of the terminal, so that a user of the terminal can manually specify which sections of the personalization data are to be updated.
  • Corresponding second personalization data can be provided to the terminal automatically, for example via an encrypted internet connection.
  • the corresponding personalization data can be pre-installed on the terminal or can be loaded using appropriate updates, for example at predefined time intervals.
  • the corresponding second personalization data can be specified by manual input by a user of the terminal who has previously authenticated himself and has provided appropriate proof of authorization.
  • the terminal can be a corresponding terminal of a city administration, to which the user can independently report his change of address. To do this, the user makes the necessary entries on the terminal and at the same time changes the address stored in the corresponding EF.
  • the updating comprises a partial physical relocation of the personalization data stored in the EF.
  • the personalization data are copied from their original storage area to another storage area.
  • the shifting can be performed as reading the data section to be shifted from the EF and writing the data section read out to a new position shifted from the original position.
  • the new position is selected in such a way that the beginning of the shifted section is directly connected to the end of the second personalization data. Writing the moved section overwrites the original data.
  • Embodiments of the invention can have the advantage that data sections within the first personalization data can also be updated, with the subsequent personalization data being at least partially retained. If, for example, an updated middle section of the personalization data is shorter than the preceding logically equivalent middle section, residual data remain within the personalization data, which can lead to problems in the interpretation of data to be read out. In principle, this can be avoided by updating the entire personalization data, i.e. overwriting it, and by updating the pointer to the logical end of the updated personalization data, complications due to residual data remaining at the end of the file are prevented. However, this can be time-consuming in the case of extensive personalization data. If only a short remaining section of the first personalization data is to be retained, it can be significantly more efficient to physically move or copy this remaining section in such a way that it is indirectly connected to the updated partial section of the personalization data.
  • Embodiments of the present inventive method can advantageously also be applied to personalization data with a TLV structure.
  • personalization data can be created in the form of a TLV (Tag Length Value) structure.
  • a TLV structure is a data structure intended to simplify the organization of data. For this purpose, in addition to the content of the data structure (value), an identifier for the type of data contained (tag) and the length of the data object is also specified in a header of the structure. If a program that can only process a certain type of data object, for example, processes a series of TLV structures, it can first check whether the data content of a TLV structure can be processed at all by reading the tag of the TLV structure. If the program determines that the type of data contained cannot be processed with the program, the program can simply skip the TLV structure, since the length of the structure is specified in the value L.
  • the chip card operating system initially sets a flag in the non-volatile electronic memory of the value or security document, which indicates the start of the update process for updating the first personalization data, and the flag after the Updating the pointer is cleared.
  • the flag initially set in the protected electronic memory for updating the personalization data indicates that the personalization data is to be changed. Only after the pointer to the logical end of the updated personalization data has been updated is the flag reset.
  • the terminal of the chip card system is a reading device for an official document, such as a reading device for an electronic identity card, an electronic residence permit or an electronic passport.
  • the value or security document is first drawn into the mechanical feeder of the terminal, so that the value or security document is completely inside the housing of the terminal after it has been drawn in. It can hereby be ensured that the value or security document is not removed from the terminal while the personalization data is being updated, since otherwise data loss could be caused by an interruption in the communication connection.
  • the document is ejected from the mechanical feeder. Ejection is to be understood here as meaning that the document is released by the mechanical feed to such an extent that a document holder can remove the document from the terminal. This can be done, for example, by ejection in the sense of a movement of the document from the mechanical feeder happen or the mechanical feeder can release a flap or opening, for example, so that the document can be gripped with the hands within the mechanical feeder.
  • the value or security document has a first contactless communication interface, while the terminal has a second contactless communication interface.
  • the method then includes setting up a communication connection between the terminal and the value or security document via the first and second contactless communication interface.
  • the transmission of the second personalization data into the protected, non-volatile memory area of the value or security document then takes place via precisely this communication link.
  • the communication connection can be an RFID or NFC connection, for example.
  • the combination of contactless communication between the value or security document and the terminal and the drawing of the value or security document into a mechanical feed could have the advantage that the mechanical feed prevents premature removal of the value or security document from the effective range of the terminal while at the same time the means for contactless communication between the value or security document and the terminal can be embedded in the value or security document.
  • Contacts that are used for contact-based data transmission could wear out due to the friction that usually occurs when using a mechanical feed.
  • this risk is effectively avoided by embedding, for example, an antenna in the value or security document body, in which case the antenna does not protrude from the value or security document at any point.
  • the establishment of the communication link between the terminal and the value or security document includes a mutual authentication of the terminal and the value or security document.
  • a secure communication channel is set up between the terminal and value or security document.
  • the personalization data is then transmitted exclusively via this secure communication channel.
  • Embodiments of the invention could have the advantage that by securing the communication between the value or security document and the terminal, spying out of the transmitted personalization data can be prevented.
  • a challenge-response method can be used for authentication.
  • authentication can be performed using the Basic Access Control (BAC) method or using the Password Authenticated Connection Establishment (PACE) method.
  • BAC Basic Access Control
  • PACE Password Authenticated Connection Establishment
  • the terminal deletes the second personalization data from the electronic memory of the terminal.
  • the electronic memory of the terminal is a volatile memory.
  • the electronic memory of the terminal could be designed as a random access memory (RAM). This would have the advantage that when the terminal is switched off, all the personalization data stored in the terminal's memory from previous compression processes are automatically deleted. A targeted deletion of the personalization data from the memory of the terminal is then no longer necessary.
  • a reloading token is used in the course of the method according to the invention, the value or security document second personalization data to be reloaded are contained on the reload token, the reload token being connected to the terminal at the beginning of the method, the connection between the terminal and reload token being configured for data transmission between the terminal and reload token, the terminal being configured to load the second personalization data to be reloaded to extract from the reload token and transfer it to the non-volatile electronic memory of the value or security document.
  • the reload token can be a smart card that is inserted into the terminal.
  • the connection between the terminal and the reload token is configured for data transmission between the terminal and the reload token.
  • the value or security document contains a certificate with a public key of an asymmetric key pair.
  • the second personalization data to be reloaded onto the value or security document, which are contained in a reload token, for example, then contain a cryptographic signature, with the value or security document being configured, after receiving the personalization data to be reloaded from the terminal, to match the cryptographic signature of the received data with the public Verify the certificate key.
  • the value or security document is configured to delete subsequently loaded second personalization data whose signature cannot be verified with the public key from the non-volatile memory of the value or security document.
  • a value or security document issuer can thereby specify who is to reload data onto the value or security document can and who can't.
  • parties who have been provided with the appropriate private key by the issuer of the value or security document, which can generate a signature can load data onto the value or security document. which can be verified with the public key of the asymmetric key pair.
  • the terminal comprises an energy source, the energy source being a self-contained internal energy source and/or an external energy source.
  • Embodiments could have the advantage that when using an internal energy source, the terminal can be designed as a portable device that is completely self-sufficient. Such a self-sufficiency would improve the security of the terminal against access by unauthorized persons, since communication only takes place between the value or security document and the terminal. Furthermore, a combination of an internal energy source, such as a battery, and an external energy source, such as a mains connection, can improve the reliability of the terminal since the probability of both energy sources failing is lower than the probability of one of the energy sources failing.
  • an internal energy source such as a battery
  • an external energy source such as a mains connection
  • the terminal includes an authentication token, with the authentication token containing data for authentication of a user of the terminal, with the authentication token being able to be configured as an exchangeable physical data carrier.
  • the data carrier can be another chip card, for example.
  • Embodiments could have the advantage that the terminal can be used by a large number of different users by exchanging the authentication token. However, this also ensures that only the user whose authentication token is currently connected to the terminal can use the terminal. It can be provided that the terminal independently checks whether a user whose authentication token is currently inserted in the terminal is actually authorized to use the terminal.
  • the value or security document is an electronic identification document, in particular a passport, identity card, visa, driver's license, vehicle registration document, vehicle registration document, company ID card, a health card, signature cards, SIM cards and/or an electronic means of payment, in particular a Bank note, bank card, credit card, bill of lading and/or other proof of entitlement.
  • an electronic identification document in particular a passport, identity card, visa, driver's license, vehicle registration document, vehicle registration document, company ID card, a health card, signature cards, SIM cards and/or an electronic means of payment, in particular a Bank note, bank card, credit card, bill of lading and/or other proof of entitlement.
  • Figure 1a 13 shows an EF 132 with a predefined physical memory length, which represents the block of memory reserved for the EF 132.
  • FIG. The physical end 166 designates the physical end of the reserved memory block. Since no personalization data 140 is stored, the logical end of file 141 is zero. Is a file 162, as in Figure 1b shown, longer than the predefined physical storage length of the EF 132, ie if the logical end 163 of the second personalization data 162 to be stored is beyond the physical end 166, the update process is aborted.
  • Figure 1c shows an EF 132 with first personalization data 140, the end of which defines the logical end 141.
  • Figure 1d 12 shows a case where the logical end 164 of the updated personalization data, which corresponds to the logical end 163 of the second personalization data 162, lies beyond the logical end 141 of the first personalization data 140.
  • the second personalization data 162 is longer than the first personalization data 140.
  • Figure 1e shows a situation when first personalization data 140 is overwritten with second personalization data 162, in which the second personalization data 162 is shorter than the first personalization data 140.
  • the logical end 163 of the second personalization data 162 ie the logical end 164 of the updated personalization data, lies before the logical end 141 of the first personalization data 140 Residual data 170 are also read out, the logical end 163 of the second personalization data 162 is identified as the logical end 164 of the updated personalization data.
  • the pointer 136 is updated accordingly, so that it points to the logical end 163 or 164.
  • the figure 2 shows a system 100 from a terminal 102 and a value or security document 110 in the form of a chip card.
  • the terminal 102 contains a communication interface 108, a processor 104 and a memory 101 for temporarily storing second personalization data 162.
  • the memory 101 can be a non-volatile flash-based memory, for example.
  • the terminal 102 shown also includes an authentication token 107, a reload token 105, a further communication interface 109 and an energy source 103.
  • the authentication token 107 and the second communication interface 109 are optional features of the terminal 102.
  • the energy source 103 can be, for example, a battery or a power-generating unit such as a fuel cell or a solar cell.
  • a closed energy source 103 could have the advantage that the terminal 102 can be made completely self-sufficient on the one hand and portable on the other.
  • the energy source 103 can also be a power pack or some other type of connection to an external energy supply.
  • a combination of external and internal energy supply is also possible, which would improve the failsafety of the terminal 102.
  • the memory 101 can be both a volatile and a non-volatile memory. In this context, it can be useful for the memory 101 to be configured as a volatile memory for the temporary storage of second personalization data 162 . This would have the particular advantage that after the terminal 102 has been switched off and the personalization data on the value or security document 110 has been successfully updated, the second personalization data 162 stored in the terminal 102 for the update is automatically updated would be deleted. This would prevent the second personalization data 162 from being misused by subsequent reading out of the terminal 102 .
  • the value or security document 110 includes a chip card operating system 118 and a chip card file system 117 with a logical data structure that includes EFs 132, 142 with personalization data 140,150.
  • Control data 128, 134, 144 are also stored in the chip card file system 117, wherein the control data 128 can be assigned to an MF 126, while the control data 134 and 144 are each assigned to an EF 132, 142 and thus to a set of personalization data 140, 150.
  • the control data 134 and 144 also each include a pointer that refers to the logical end 136, 146 of the associated personalization data 140, 150 (not claimed embodiment).
  • communication between the terminal 102 and the value or security document 110 is made possible by the communication interface 108 of the terminal 102 .
  • the value or security document 110 can be addressed through the communication interface 108, as a result of which an updating or reloading process can be initiated.
  • the communication interface 108 can be configured in accordance with ISO 14443, for example.
  • a corresponding application program 106 can be provided in the processor 104 of the terminal 102 for this purpose.
  • a mutual exchange of security certificates can be provided in the course of the authentication method, which are stored in the memory 124 of the value or security document 110 or in a corresponding authentication token 107 of the terminal 102 .
  • the authentication methods that are possible within the meaning of the present invention are not limited to this.
  • the processor 104 of the Terminals 102 store second personalization data 162, which are stored, for example, in the reload token 105 of the terminal 102, in the memory 124 of the value or security document 110.
  • an indicator ID is also transmitted to the value or security document 110, for example as part of a corresponding APDU 158, in which the value or security document 110 about the identity of the storage of the second personalization data 162 provided EFs 132 is informed.
  • the further communication interface 109 of the terminal 102 can be configured for the administration of the terminal 102, for example.
  • the communication interface 109 can be an Ethernet connection, for example.
  • the authentication token 107 and the reload token 105 can be designed both as a software token and as a hardware token, for example in the form of a chip card for insertion into the terminal 102 .
  • the reload token 105 can be supplied by a manufacturer of the value or security document to be updated.
  • the reload token 105 can be permanently installed in the terminal 102 so that manufacturer-specific update data would have to be transmitted to the terminal 102 via the communication interface 109 .
  • the reload token 105 can also be configured as a storage area within the terminal 102 . Accordingly, second personalization data 162 can be stored in the memory 101 and/or in the reload token 105 . Different update data can also be stored in memory 101 and in reload token 105 .
  • the communication interface 108 via which communication between the terminal 102 and the value or security document 110 is to be ensured, can additionally have a mechanical feeder for partially or completely receiving the value or security document 110 in the terminal 102.
  • the collection can be such that the valuable or security document 110 is withdrawn at least for the duration of the reloading process before removal the terminal 102 by a user. This ensures uninterrupted communication and power supply during the reloading process.
  • the terminal 102 is configured to replace at least parts of the personalization data 140, 150 stored in the value or security document 110 in the course of a reloading process.
  • the reloading process is a multi-part process that is preceded by an initialization.
  • the second personalization data 162 for updating is either uploaded to the terminal 102 as a software token via the communication interface 109 or introduced into the terminal 102 as a hardware token 105 .
  • the figure 3 shows a chip card system 100 with a terminal 102.
  • the terminal 102 can be, for example, a reading device for an official document, in particular for an electronic identity card, an electronic residence permit or an electronic passport.
  • Terminal 102 has a processor 104 for executing an application program 106, which is interoperable with a value or security document 110 in the form of a chip card, and an interface 108 for establishing a communication link with a corresponding interface 112 of chip card 110.
  • the interfaces 108 and 112 are configured as contactless interfaces, in particular as RFID or NFC interfaces.
  • the chip card 110 preferably does not have its own energy supply, but is supplied with electrical energy by coupling electromagnetic energy from the interface 108 into the interface 112, for which purpose the interface 112 has an antenna.
  • the smart card 110 has a processor 114 for executing a program module 116 for the authentication of the terminal 102 or the mutual authentication of the terminal 102 and the smart card 110.
  • the program module 116 for example, those steps of a challenge-response protocol implement, which concern the chip card 110, wherein the application program 106 can then implement those steps of the challenge-response protocol, which concern the terminal 102.
  • Another possibility is authentication by means of a secret identifier, for example a so-called PIN, which a user enters into the terminal and which is checked by the program module 116, for example according to the PACE protocol, as specified by the Federal Office for Information Security (BSI) has been specified.
  • BSI Federal Office for Information Security
  • the processor 114 is also used to run a chip card operating system 118 and has a volatile main memory 120.
  • the processor 116 is connected to the interface 112 of the chip card 110 and via an internal data bus 122 to a non-volatile, protected electronic memory 124.
  • Files of a chip card file system 117 are stored in the memory 124 and form a file tree.
  • the figure 3 shows an example of a MF 126 of the file tree, not according to the invention, which contains control data 128 including a pointer 130 to a successor node, ie the EF 132 .
  • the unclaimed EF 132 also includes control data 134, including a pointer 138 to its child node in the file tree, namely an EF 142, and a pointer 136 to the logical end of the personalization data 140 also stored in the EF 132.
  • a structure analogous thereto has unclaimed EF 142, which includes control data 144, including a pointer 146 to the logical end of the personalization data 150 also stored in the EF 142 and a pointer 148 to one in the figure 3 child nodes, not shown, of EF 142 in the file tree.
  • the chip card 110 receives second personalization data 162 from the terminal 102, for example by the application program 106 sending a command APDU 158 from the interface 108 to the interface 112, which contains the second personalization data 162 and a specification ID of the EF of the chip card file system 117 whose personalization data are to be changed.
  • the following is an example assumed that this is the EF 132 or its personalization data 140.
  • a flag F 152 is shown in the memory 124, which the chip card operating system 118 initially sets at the beginning of the update process and deletes it again after its completion. Furthermore, together with the flag F 152, a log file P can also be created in the memory 124 in order to log the steps of the update process.
  • the terminal 102 is activated.
  • activation can take place by actuating a power switch, or the terminal 102 can be configured in such a way that it is woken up from an idle state when a value or security document 110 is inserted into a corresponding mechanical feeder.
  • An operator authentication can then be provided, for example by means of a password query, which, if successful, initiates the update process.
  • the terminal 102 must have a suitable input option, such as a keyboard, and the authentication token 107 .
  • the terminal 102 After the terminal 102 has been activated, energy is transferred to the value or security document 110, whereby the value or security document 110 is also activated. A communication channel is then set up between the terminal 102 and the value or security document 110 . This can be done, for example, by inserting the value or security document 110 into the slot of a card reader or by setting up a wireless connection.
  • the terminal 102 and the value or security document 110 are then mutually authenticated, so that a secure channel can be set up between the terminal 102 and the value or security document 110 .
  • corresponding authentication data can be stored in the terminal 102, for example in the authentication token 107, which are used in the course of the mutual authentication.
  • a necessary authorization of the terminal 102 for reloading data into the value or security document 110 is obtained by the authentication of the terminal 102 with respect to the value or security document 110 .
  • the terminal 102 transmits cryptographic information to the value or security document 110 as proof of an access authorization, the transmitted cryptographic information fulfilling a cryptographic access condition of the EF 132.
  • the terminal In a subsequent method step, the terminal generates or activates an already existing key for encrypting all or part of the second personalization data 162 and the associated write command.
  • the second personalization data 162 and the associated write command are then transmitted in encrypted form from the terminal 102 to the value or security document 110 via the secure channel.
  • the second personalization data 162 on the value or security document 110 is then decrypted and written to the EF 132 in accordance with the write command in order to update the first personalization data 140 .
  • the pointer 136 is updated to point to the logical end 164 of the updated personalization data.
  • the successful implementation of the update is confirmed by the value or security document 110 to the terminal 102 by transmitting a response with a write confirmation.
  • connection and the secure channel between the terminal 102 and the value or security document 110 are then cleared and the power supply is terminated. As a result, the value or security document 110 is deactivated.
  • the value or security document 110 was drawn into a corresponding mechanical feeder of the terminal 102, the value or security document 110 is issued and the terminal 102 is deactivated again.
  • the procedure for updating the personalization data 140 of the EF 132 can be as follows, for example, as in FIG figure 5 shown:
  • the terminal 102 is first authenticated with respect to the chip card 110.
  • an authorization check can also be carried out, namely whether the terminal 102 has the necessary rights to change personalization data 140. This can be done, for example, by the terminal 102 transmitting an authorization certificate to the chip card 110, the rights of the terminal 102 to change the personalization data 140 being specified in the authorization certificate.
  • the authorization certificate contains cryptographic information that satisfies a cryptographic access condition of the EF 132 defined in the control data 134 .
  • the chip card 110 receives second personalization data 162 from the terminal 102, for example by the application program 106 sending a command APDU 158 from the interface 108 to the interface 112, which contains the second personalization data 162 and also a specification ID of the EF of the Chip card file system whose first personalization data are to be changed.
  • This is, for example, the EF 132 or its personalization data 140 without loss of generality.
  • step 504 the chip card operating system 118 sets a flag F 152 in the memory 124.
  • a log file P can also be created in the memory 124 to log the subsequent steps of the update process.
  • step 506 the chip card operating system 118 accesses the memory 124 via the internal data bus 122 and partially overwrites the first personalization data 140 with the second personalization data 162 of the APDU 158, thereby replacing the previous version of the personalization data 140.
  • the second personalization data 162 is shorter in this case than the first personalization data 140, so only partial overwriting occurs.
  • a remainder of the previous version of the personalization data 140 remains in the EF 132 and is arranged immediately following the logical end 163 of the second personalization data 162, the logical end 163 of the second personalization data 162 in the present case being aligned with the logical end 164 of the updated personalization data coincides.
  • the command APDU 158 contains the personalization data 162 and an identifier (ID) 160 of that file whose personalization data are to be changed, here the EF 132 whose personalization data 140 are to be changed.
  • ID an identifier
  • step 508 the pointer 136 is then updated so that it no longer points to the logical end 141 of the personalization data 140 but to the logical end 164 of the updated personalization data.
  • the logical end 163 of the second personalization data 162 coincides with the logical end 164 of the updated personalization data. The rest of the data in the data system can remain unchanged.
  • the flag 152 is reset in step 510 and the log file 154 is deleted.
  • step 512 a reply with a write confirmation is generated from the value or security document and sent to the terminal 102 in step 514 via the contactless communication interface 112 .
  • Steps 600, 602, 604, and 606 correspond to steps 500, 502, 504, and 506 of FIG figure 5 .
  • Step 606 is followed by step 607, in which it is checked on the basis of an indicator in the write command whether it is a final write command or whether further write commands follow. If another write command follows, step 606 is repeated with the following write command. The corresponding loop is run through until a corresponding indicator identifies a write command as the final write command. In this case the method continues with step 608 .
  • the further steps 608, 610, 612 and 614 correspond to the steps 508, 510, 512 and 514 from figure 5 .
  • Figures 7a to 7c Schematic representations of an update method according to the invention are shown.
  • Figure 7a shows an EF 132, which has first personalization data 140.
  • This personalization data 140 is divided into three sections 140', 140' and 140'.
  • the logical end 141 of the first personalization data 140 is defined by the end of the third section 140′′′.
  • the third section 140′′′ is to be retained.
  • the corresponding write command has an offset value, which 'corresponds to the length of the first section 140.
  • residual data 170 remains at the end of the updated data block, but this can be ignored by setting the pointer 136 to the end of the shifted subsection 140′′′.
  • the end of the shifted third section 140′′′ is thus defined as the logical end 164 of the updated personalization data.
  • the residual data 170 between the logical end 164 and the logical end 141 of the first personalization data will no longer be read out in future read-out processes, since a read-out only takes place up to the point specified by the pointer 136 .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • Mathematical Physics (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Claims (13)

  1. Procédé d'actualisation de premières données de personnalisation (140) d'un document de valeur ou de sécurité (110) avec des deuxièmes données de personnalisation (162),
    dans lequel
    le document de valeur ou de sécurité (110) présente une mémoire électronique (124) non volatile avec un système d'exploitation de carte à puce (118) et un système de données de carte à puce (117), dans lequel le système de données de carte à puce (117) comprend un fichier dédié (126) avec au moins un fichier élémentaire (132), dans lequel le fichier élémentaire (132) présente une taille de mémoire physique prédéfinie,
    dans lequel le fichier élémentaire (132) comprend des données de commande (134) et des premières données de personnalisation (140),
    dans lequel les données de commande (134) comprennent une condition d'accès cryptographique et une lecture et/ou une écriture ne sont possibles dans le fichier élémentaire (132) que lorsque la condition d'accès cryptographique est satisfaite, et dans lequel
    un pointeur (136) est enregistré dans le système de données de carte à puce (117), qui indique la fin logique (141) des premières données de personnalisation (140) dans le fichier élémentaire (132),
    dans lequel le document de valeur ou de sécurité (110) présente en outre une interface de communication (112) sans contact pour la réception ou l'envoi de données de personnalisation (162),
    dans lequel l'actualisation des premières données de personnalisation (140) avec des deuxièmes données de personnalisation (162) comprend :
    • un approvisionnement d'énergie électrique dans le document de valeur ou de sécurité (110) par le biais de l'interface de communication (112) sans contact permettant l'alimentation en énergie du document de valeur ou de sécurité (110) par un terminal (102),
    • une authentification réciproque et une preuve d'une autorisation d'accès du terminal (102) et du document de valeur ou de sécurité (110) par le biais de l'interface de communication (112) sans contact, où la preuve de l'autorisation d'accès comprend au moins une transmission d'une information cryptographique du terminal (102) vers le document de valeur ou de sécurité (110), où l'information cryptographique transmise satisfait la condition d'accès cryptographique du fichier élémentaire (132),
    à condition d'une authentification réciproque réussie et d'au moins une satisfaction de la condition d'accès cryptographique du fichier élémentaire (132) :
    • la réception d'une première instruction d'écriture du terminal (102) pour l'actualisation des premières données de personnalisation (140) dans le fichier élémentaire (132) avec les deuxièmes données de personnalisation (162) par le biais de l'interface de communication (112) sans contact,
    dans lequel le système d'exploitation de carte à puce (118) est configuré de telle manière, qu'en réponse à la réception de l'instruction d'écriture, il exécute les fonctions suivantes :
    • l'actualisation des premières données de personnalisation (140) par l'écriture des deuxièmes données de personnalisation (162) dans le fichier élémentaire (132),
    • la détermination de la fin logique (163) des données de personnalisation actualisées,
    • l'établissement d'un pointeur (136) actualisé qui indique la fin logique (163) des données de personnalisation,
    • l'enregistrement du pointeur (136) actualisé dans le système de données de carte à puce (117),
    • l'établissement d'une réponse avec une confirmation d'écriture et
    • l'envoi d'une réponse au terminal (102) par le biais de l'interface de communication (112) sans contact,
    dans lequel le fichier dédié (126) comprend une multiplicité de fichiers élémentaires (132, 142) et un tableau de pointeur, dans lequel le tableau de pointeur associe chaque fichier élémentaire (132, 142) à un pointeur (136, 146), lequel indique la fin logique (141, 151) des données de personnalisation (140, 150) enregistrées dans le fichier élémentaire (132, 142) associé.
  2. Procédé selon l'une des revendications précédentes, dans lequel les données de personnalisation actualisées sont plus courtes que les premières données de personnalisation (140), de sorte que la fin logique (163) des données de personnalisation actualisées est disposée avant la fin logique (141) des premières données de personnalisation (140).
  3. Procédé selon l'une des revendications précédentes, où le procédé, avant l'écriture des deuxièmes données de personnalisation (162), exécute les vérifications suivantes :
    • la détermination de la longueur du fichier élémentaire (132) nécessaire pour le processus d'écriture,
    • la détermination si la longueur du fichier élémentaire (132) correspond au moins à la longueur précédemment déterminée, où le procédé n'est poursuivi que dans le cas où la longueur du fichier élémentaire (132) est supérieure ou égale à la longueur précédemment déterminée.
  4. Procédé selon la revendication 3, dans lequel la détermination de la longueur du fichier élémentaire (132) nécessaire pour le processus d'écriture comprend :
    • la détermination de la fin logique (141) des premières données de personnalisation (140) par la lecture du pointeur (136) à partir du système de données de carte à puce (117),
    • la détermination de la fin logique prévisible (163) des données de personnalisation actualisées suite à l'actualisation des premières données de personnalisation (140) dans le fichier élémentaire (132) sur la base de la longueur des deuxièmes données de personnalisation (162).
  5. Procédé selon l'une des revendications précédentes, dans lequel la fin des données logique (164) est placée après l'écriture des deuxièmes données de personnalisation (162) à la fin (163) des deuxièmes données de personnalisation (162) par l'établissement du pointeur (136) actualisé, qui indique la fin logique (164) des données de personnalisation actualisées.
  6. Procédé selon l'une des revendications 1 à 4, dans lequel l'instruction d'écriture est une instruction d'écriture d'une suite d'instructions d'écriture,
    dans lequel une dernière instruction d'écriture de la suite d'instructions d'écriture comprend un indicateur qui indique que la dernière instruction d'écriture est une instruction d'écriture finale et dans lequel les instructions d'écriture précédentes comprennent respectivement un indicateur qui indique qu'une nouvelle instruction d'écriture suit.
  7. Procédé selon la revendication 6, où le procédé comprend :
    avant l'actualisation du pointeur (136), la vérification à l'aide de l'indicateur, si l'instruction d'écriture est une instruction d'écriture finale,
    dans le cas où l'instruction d'écriture n'est pas une instruction d'écriture finale,
    l'exécution de l'instruction d'écriture suivante dans la suite,
    dans le cas où l'instruction d'écriture est une instruction d'écriture finale,
    la mise en place de la fin de données logique (164) après l'exécution de l'instruction d'écriture finale à la fin des données de personnalisation actualisées par l'établissement d'un pointeur (136) actualisé qui indique la fin logique (164) des données de personnalisation actualisées.
  8. Procédé selon l'une des revendications 1 à 4, dans lequel la fin des données logique (164), en réponse à une sélection d'une autre donnée et/ou d'une autre liste, est placée à la fin des données de personnalisation actualisées par l'établissement d'un pointeur (136) actualisé qui indique la fin logique (164) des données de personnalisation actualisées.
  9. Procédé selon l'une des revendications précédentes, dans lequel l'actualisation des premières données de personnalisation (140) a lieu par un écrasement avec les deuxièmes données de personnalisation (162) en commençant au début des premières données de personnalisation (140).
  10. Procédé selon l'une des revendications 1 à 8, dans lequel l'instruction d'écriture comprend une valeur de décalage, laquelle détermine un point de départ dans la longueur d'enregistrement du fichier élémentaire (132) pour l'actualisation des premières données de personnalisation (140) et les premières données de personnalisation (140) sont actualisées par un écrasement avec les deuxième données de personnalisation (162), ou
    dans lequel les premières données de personnalisation (140) sont lues avant l'actualisation, sur la base des premières données de personnalisation (140) lues, un point de départ est déterminé dans la longueur d'enregistrement du fichier élémentaire (132) pour l'actualisation des premières données de personnalisation (140) et les premières données de personnalisation (140) sont actualisées par l'écrasement avec les deuxièmes données de personnalisation (162).
  11. Procédé selon l'une des revendications précédentes, dans lequel l'instruction d'écriture comprend une instruction pour la conservation d'une partie (140‴) des premières données de personnalisation (140), laquelle est disposée après une partie (140") à actualiser des premières données de personnalisation (140), où la conservation de la partie (140") disposée après comprend :
    • après l'écriture des deuxièmes données de personnalisation (162), où les deuxièmes données de personnalisation (162) sont plus courtes que la partie (140ʺ) à actualiser des premières données de personnalisation (140), un décalage de la partie (140") suivante à la fin (163) des deuxièmes données de personnalisation (162),
    • la désignation de la fin de la partie (140") suivante en tant que fin logique (164) des données de personnalisation actualisées par l'établissement d'un pointeur (136) actualisé qui indique la fin logique (164) des données de personnalisation actualisées.
  12. Procédé selon l'une des revendications précédentes, dans lequel, au début de l'actualisation des premières données de personnalisation (140), initialement avant le système d'exploitation de carte à puce (118), un drapeau (152) est placé dans la mémoire électronique (124) non volatile du document de valeur ou de sécurité (110), lequel indique le début du processus d'actualisation pour l'actualisation des premières données de personnalisation (140), et où le drapeau (152) est effacé après l'actualisation du pointeur (136), et/ou
    en outre, avec un jeton de recharge (105), où les deuxièmes données de personnalisation (162) à recharger sur le document de valeur ou de sécurité (110) sont contenues sur le jeton de recharge (105), où le jeton de recharge (105) est relié avec le terminal (102) au début du procédé, où la liaison entre le terminal (102) et le jeton de recharge (105) est conçue pour une transmission de données entre le terminal (102) et le jeton de recharge (105), où le terminal (102) est conçu pour extraire les deuxièmes données de personnalisation (162) à recharger du jeton de recharge (105) et les transmettre dans la mémoire électronique (124) non volatile du document de valeur ou de sécurité (110), et/ou
    dans lequel le document de valeur ou de sécurité (110) contient un certificat avec une clé publique d'une première paire de clés asymétrique, où les deuxièmes données de personnalisation (162) à recharger sur le document de valeur ou de sécurité (110) contiennent une signature cryptographique, où le document de valeur ou de sécurité (110) est conçu pour, après la réception des deuxièmes données de personnalisation (162) à recharger à partir du terminal (102), vérifier la signature cryptographique des deuxièmes données de personnalisation (162) reçues avec la clé publique du certificat, où le document de valeur ou de sécurité (110) efface les deuxièmes données de personnalisation (162) rechargées dont la signature ne peut pas être vérifiée avec la clé publique, de la mémoire électronique (124) non volatile du document de valeur ou de sécurité (110).
  13. Procédé selon l'une des revendications précédentes, dans lequel le terminal (102) présente au moins une mémoire électronique (101), une interface de communication (108, 109) sans contact, un boitier fermé et un dispositif d'insertion mécanique, où le dispositif d'insertion mécanique est conçu pour sécuriser le document de valeur ou de sécurité (110) contre un prélèvement hors du terminal, où le procédé présente en outre ce qui suit :
    • l'insertion du document de valeur ou de sécurité (110) dans le dispositif d'insertion mécanique du terminal (102) de sorte que le document de valeur ou de sécurité (110) se trouve totalement à l'intérieur du boitier du terminal (102) après l'insertion,
    • la recharge des deuxièmes données de personnalisation (162) sur le document de valeur ou de sécurité (110) pour l'actualisation des premières données de personnalisation (140) par les deuxièmes données de personnalisation (162),
    • le rejet du document de valeur ou de sécurité (110) hors du dispositif d'insertion mécanique du terminal (102) à la fin de l'actualisation.
EP16728664.0A 2015-06-11 2016-06-06 Procédé de mise à jour de données de personnalisation Active EP3308278B1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22160148.7A EP4068103A1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour des données de personnalisation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102015210719.1A DE102015210719A1 (de) 2015-06-11 2015-06-11 Verfahren zum Aktualisieren von Personalisierungsdaten
PCT/EP2016/062771 WO2016198350A1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour de données de personnalisation

Related Child Applications (1)

Application Number Title Priority Date Filing Date
EP22160148.7A Division EP4068103A1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour des données de personnalisation

Publications (2)

Publication Number Publication Date
EP3308278A1 EP3308278A1 (fr) 2018-04-18
EP3308278B1 true EP3308278B1 (fr) 2022-04-06

Family

ID=56119480

Family Applications (2)

Application Number Title Priority Date Filing Date
EP16728664.0A Active EP3308278B1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour de données de personnalisation
EP22160148.7A Pending EP4068103A1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour des données de personnalisation

Family Applications After (1)

Application Number Title Priority Date Filing Date
EP22160148.7A Pending EP4068103A1 (fr) 2015-06-11 2016-06-06 Procédé de mise à jour des données de personnalisation

Country Status (3)

Country Link
EP (2) EP3308278B1 (fr)
DE (1) DE102015210719A1 (fr)
WO (1) WO2016198350A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113469677B (zh) * 2021-06-11 2024-04-19 深圳市雪球科技有限公司 DESFire卡数据的安全读写方法和装置
CN115102737B (zh) * 2022-06-15 2024-05-14 交通运输通信信息集团有限公司 面向交通一卡通的esam远程发行方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040139021A1 (en) * 2002-10-07 2004-07-15 Visa International Service Association Method and system for facilitating data access and management on a secure token
US7878505B2 (en) * 2003-08-19 2011-02-01 Hid Global Corporation Credential substrate rotator and processing module
DE102006006489A1 (de) * 2006-02-10 2007-08-16 Bundesdruckerei Gmbh Verfahren zur Durchführung eines Schreibzugriffs, Computerprogrammprodukt, Computersystem und Chipkarte
DE102006030406A1 (de) * 2006-06-29 2008-01-03 Bundesdruckerei Gmbh Wert- oder Sicherheitsdokument mit zumindest zwei Anzeigevorrichtungen
JP5150672B2 (ja) * 2010-03-18 2013-02-20 株式会社東芝 携帯可能電子装置、及び携帯可能電子装置の制御方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
EP4068103A1 (fr) 2022-10-05
DE102015210719A8 (de) 2018-01-11
DE102015210719A1 (de) 2016-12-15
WO2016198350A1 (fr) 2016-12-15
EP3308278A1 (fr) 2018-04-18

Similar Documents

Publication Publication Date Title
DE69016765T2 (de) Verfahren zur Erzeugung einer Pseudozufallszahl in einem Datenbearbeitungssystem und ein System zur Ausführung dieses Verfahrens.
WO2016055358A1 (fr) Procédé pour charger des instructions de programme exécutables dans une carte à puce opérationnelle
EP2864871B1 (fr) Procédé et dispositif pour échanger le système d'exploitation d'un support de données portable doté de ressources limitées
EP3308278B1 (fr) Procédé de mise à jour de données de personnalisation
EP1196902A1 (fr) Procede pour faire fonctionner un support de donnees con u pour executer des programmes fonctionnels rechargeables
EP2272025B1 (fr) Système et procédé de production de supports utilisateur
EP3754530B1 (fr) Procédé pour recharger un logiciel sur une carte à puce par l'intermédiaire d'un dispositif automatique de rechargement
DE19939280A1 (de) Sicheres Personalisieren von Chipkarten
EP3215977A1 (fr) Procédé de modification d'une structure de données enregistrée dans une carte à puce, dispositif de signature et système électronique
EP3175383B1 (fr) Procédé pour modifier les données de contrôle d'une carte à puce et système de carte à puce
EP3329415B1 (fr) Carte a puce avec une application principale et une application persistante permettant de mettre a jour l'application principale sans modifier les donnees d'utilisateur stockees dans l'application persistante
DE102014224186B4 (de) Verfahren zum Nachladen einer Anwendung auf ein Dokument
EP3215957B1 (fr) Carte à puce, système de carte à puce et procédé d'accès à une carte à puce
EP3271825B1 (fr) Procédé de stockage de données d'utilisateur dans un document
EP3286687B1 (fr) Procédé de compression de données d'utilisateur d'un document
DE10219731A1 (de) Verfahren zur Ausführung einer Datentransaktion mittels einer aus einer Haupt- und einer trennbaren Hilfskomponente bestehenden Transaktionsvorrichtung
EP3323072B1 (fr) Procédé pour lire des attributs dans un jeton id, jeton id, système informatique de fournisseur d'attribut et système informatique

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20180111

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20201117

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20211111

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1482043

Country of ref document: AT

Kind code of ref document: T

Effective date: 20220415

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 502016014732

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: GERMAN

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220808

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220706

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220707

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220706

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220806

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 502016014732

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20220630

26N No opposition filed

Effective date: 20230110

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220606

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220630

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220606

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220630

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220630

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230526

REG Reference to a national code

Ref country code: AT

Ref legal event code: MM01

Ref document number: 1482043

Country of ref document: AT

Kind code of ref document: T

Effective date: 20220606

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220606

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20160606

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20240620

Year of fee payment: 9

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240617

Year of fee payment: 9

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240621

Year of fee payment: 9

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20220406